Terraform Associate · Domain 7 of 8

Terraform Associate Domain 7: Maintain infrastructure with Terraform

This domain covers ongoing maintenance of Terraform-managed infrastructure: importing existing infrastructure into your workspace, using the CLI to inspect state, and using verbose logging to troubleshoot.

Exam weight estimate
Not published
Official objectives
3
Estimated questions estimate
~5
Suggested study time estimate
5–10 hrs

About 9 min read Reviewed October 2026

Overview

Maintain infrastructure with Terraform covers the operational tasks of keeping Terraform-managed infrastructure healthy over time. It has three objectives. Importing existing infrastructure covers bringing resources that already exist into Terraform's state so Terraform can manage them. Using the CLI to inspect state covers commands to view and query the resources and attributes Terraform tracks. Using verbose logging covers enabling detailed logs to troubleshoot Terraform's behavior when something goes wrong.

Though smaller, this domain covers real maintenance skills. The exam rewards knowing how to import existing resources rather than recreating them, how to inspect state to understand what Terraform manages, and when and how to turn on verbose logging to diagnose problems. These tasks keep Terraform's view of infrastructure accurate and help resolve issues, building on the state and workflow domains.

How it's tested

Terraform Associate questions in this domain test importing existing resources, inspecting state, and using verbose logging. Maintenance questions often describe existing or misbehaving infrastructure, so decide whether the task is importing, inspecting state with terraform state list or show, or diagnosing with verbose logs.

  • Import existing resources

    An existing-resource need is described, and you choose import.

  • Inspect state

    A need to see what Terraform manages is described, and you choose the state inspection command.

  • Troubleshoot with logs

    A diagnosis need is described, and you enable verbose logging.

Reasoning it through

A resource was created manually in the cloud and must now be managed by Terraform without downtime. Writing configuration and applying would try to create a duplicate. Running terraform import brings the existing resource into state so Terraform manages it in place, after which configuration can be written to match, which is the non-destructive approach the exam expects for adopting existing infrastructure.

Objectives 3

Official objectives from the HashiCorp outline, in outline order.

7a Import existing infrastructure into your Terraform workspaceBringing existing resources into state.
What it means
This covers importing existing infrastructure, resources created outside Terraform, into Terraform's state so Terraform can manage them going forward, without recreating them.
What to understand
terraform import associates an existing real resource with a resource address in state, so Terraform begins managing it. Configuration must then be written to match the imported resource. Import avoids the downtime and risk of deleting and recreating resources to bring them under management.
How it shows up
An existing-resource adoption need is described, and you must choose import.
Common confusion
Recreating a resource instead of importing it; import brings an existing resource under management without recreating it.
7b Use the CLI to inspect stateViewing and querying what Terraform tracks.
What it means
This covers using the Terraform CLI to inspect state, listing the resources in state and showing their attributes, to understand what Terraform manages and its recorded values.
What to understand
State inspection commands list the resources Terraform tracks and show their attributes, which helps verify what is managed, troubleshoot, and plan state operations. Inspecting state is a read-only way to understand Terraform's view of the infrastructure.
How it shows up
A need to see managed resources is described, and you must choose the state inspection command.
Common confusion
Confusing inspecting state with inspecting real infrastructure; state inspection shows Terraform's recorded view.
7c Describe when and how to use verbose loggingEnabling detailed logs to troubleshoot.
What it means
This covers enabling verbose logging through the log-level environment variable to produce detailed logs of Terraform's internal behavior, used to troubleshoot errors and unexpected behavior.
What to understand
Verbose logging is enabled by setting the log-level environment variable to a level such as TRACE or DEBUG, producing detailed output about what Terraform and its providers are doing. It is used for troubleshooting, not normal runs, and can be directed to a file. It helps diagnose hard problems.
How it shows up
A troubleshooting need is described, and you must enable verbose logging.
Common confusion
Not knowing that verbose logging is controlled by an environment variable and is meant for troubleshooting.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • terraform import

    Brings an existing resource into state.

    Remember
    Manage without recreating.
    Tested as
    Import questions.
    Trap
    Recreating instead.

  • Resource address

    Where an imported resource is placed in state.

    Remember
    Import targets an address.
    Tested as
    Import questions.
    Trap
    Mismatching the address.

  • Configuration after import

    Config must match the imported resource.

    Remember
    Write it to avoid changes.
    Tested as
    Import questions.
    Trap
    Importing without matching config.

  • State inspection

    Listing and showing managed resources.

    Remember
    Read-only view of state.
    Tested as
    Inspection questions.
    Trap
    Confusing with real infrastructure.

  • State list

    Shows resources tracked in state.

    Remember
    Verify what Terraform manages.
    Tested as
    Inspection questions.
    Trap
    Overlooking it.

  • State show

    Shows a resource's attributes in state.

    Remember
    Inspect recorded values.
    Tested as
    Inspection questions.
    Trap
    Expecting live values.

  • Verbose logging

    Detailed logs for troubleshooting.

    Remember
    Set the log-level environment variable.
    Tested as
    Troubleshooting questions.
    Trap
    Not knowing how to enable it.

  • Log levels

    TRACE, DEBUG and others.

    Remember
    More detail at higher verbosity.
    Tested as
    Troubleshooting questions.
    Trap
    Using verbose logs for normal runs.

  • Log to a file

    Directing logs to a path.

    Remember
    Capture logs for analysis.
    Tested as
    Troubleshooting questions.
    Trap
    Losing log output.

  • Non-destructive adoption

    Managing existing resources safely.

    Remember
    Import avoids downtime.
    Tested as
    Maintenance questions.
    Trap
    Deleting and recreating.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Import vs. recreate

ConceptMeaningKey differenceCommon trap
terraform import Adopt an existing resource No downtime, no recreation Recreating unnecessarily
Recreate Delete and create anew Downtime and risk Using to adopt existing resources

Inspect state vs. inspect reality

ConceptMeaningKey differenceCommon trap
State inspection Terraform's recorded view What Terraform manages Expecting live values
Real infrastructure The actual resources May differ if drifted Confusing with state

Normal run vs. verbose logging

ConceptMeaningKey differenceCommon trap
Normal run Standard output Everyday use Expecting deep detail
Verbose logging Detailed internal logs Troubleshooting only Using it routinely

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Recreate to adopt

    What candidates pick
    Delete a manually created resource and let Terraform recreate it to manage it.
    Why it looks right
    It brings the resource under Terraform.
    Why it's wrong
    terraform import adopts the existing resource into state without downtime; recreating causes disruption and risk.

    Clue to watch for An existing resource must be managed without downtime.

  2. Import without config

    What candidates pick
    Run terraform import and expect Terraform to generate matching configuration automatically.
    Why it looks right
    Import brings it into state.
    Why it's wrong
    After import, matching configuration must be written so the next plan does not try to change or destroy the resource.

    Clue to watch for A plan after import shows unexpected changes.

  3. State show is live

    What candidates pick
    Use state inspection to read the resource's current live values in the cloud.
    Why it looks right
    It shows resource attributes.
    Why it's wrong
    State inspection shows Terraform's recorded view, which can differ from reality if drift has occurred.

    Clue to watch for The need is the actual current cloud values.

  4. Verbose logs routinely

    What candidates pick
    Run every Terraform command with maximum verbose logging.
    Why it looks right
    More information seems better.
    Why it's wrong
    Verbose logging is for troubleshooting; routine use produces excessive noise. Enable it when diagnosing a problem.

    Clue to watch for The task is normal operation, not debugging.

  5. No logging for a hard bug

    What candidates pick
    Try to diagnose a confusing Terraform error with only standard output.
    Why it looks right
    Standard output is familiar.
    Why it's wrong
    Enabling verbose logging via the log-level environment variable reveals detailed internal behavior that standard output does not.

    Clue to watch for A difficult problem needs deeper diagnostic detail.

Answer framework

For any Domain 7 scenario, use these steps to find the answer the exam expects.

  1. Identify whether the task is importing existing resources, inspecting state, or troubleshooting.
  2. To adopt existing infrastructure, use terraform import to bring the resource into state, then write matching configuration so plans are clean.
  3. Use state inspection commands to list managed resources and show their recorded attributes, remembering this is Terraform's view, not live reality.
  4. For troubleshooting, enable verbose logging by setting the log-level environment variable and optionally directing logs to a file.
  5. Use verbose logging only while diagnosing, and return to normal output for routine runs. Where two commands seem to fit, prefer the one that inspects or imports without changing infrastructure, such as terraform state list or an import block.

Practice question

A cloud resource was created manually and now must be managed by Terraform without deleting and recreating it, so there is no downtime. What is the correct approach?

Want more like this? The Terraform Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Approach this domain as practical maintenance skills. Start with import, the highest-value task: understand that terraform import adopts an existing resource into state without recreating it, and that you must write matching configuration afterward so plans are clean. Practice importing a manually created resource.

Then learn to inspect state with the CLI, listing managed resources and showing their attributes, and remember this shows Terraform's recorded view rather than live reality. Finally, learn verbose logging: that it is enabled by the log-level environment variable, is meant for troubleshooting rather than routine use, and can be directed to a file.

Because these are hands-on tasks, practicing import, inspection and logging in a demo environment is the best preparation. Import one manually created resource, inspect it with terraform state show, and rerun a plan with TF_LOG=DEBUG to practice reading the output, including the provider and core log lines that point to a failing API call. Afterwards, move to Domain 8, HCP Terraform.

FAQ

What does terraform import do?

It associates an existing real resource with a resource address in Terraform's state, so Terraform manages it going forward without deleting and recreating it. Matching configuration must then be written.

Do I need to write configuration after importing?

Yes. After importing a resource into state, you write configuration that matches it, so the next plan does not try to change or destroy the resource.

What does inspecting state show?

The resources Terraform tracks and their recorded attributes, which is Terraform's view of the infrastructure. It can differ from the live infrastructure if drift has occurred.

How do I enable verbose logging?

Set the log-level environment variable to a level such as TRACE or DEBUG to produce detailed logs of Terraform's internal behavior, optionally directing the output to a file. It is meant for troubleshooting.

Why import instead of recreating a resource?

Importing adopts an existing resource into management without downtime or risk, whereas deleting and recreating disrupts service and can cause data loss.

When should I use verbose logging?

When troubleshooting an error or unexpected behavior that standard output does not explain. It is not meant for routine runs, where it produces excessive noise.

How does Domain 7 connect to the rest of the exam?

These maintenance tasks operate on the state of Domain 6, the resources of Domain 4, and use the CLI workflow of Domain 3 to keep Terraform's view of infrastructure accurate.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

You have covered importing, inspecting state and verbose logging. Test whether you can maintain infrastructure under exam conditions.

Take the Terraform Associate practice test Check your Terraform Associate readiness

Keep going